fortinet.fortimanager.fmgr_pkg_firewall_policy_obj – Configure IPv4 policies.¶
Note
This plugin is part of the fortinet.fortimanager collection (version 1.0.5).
To install it use: ansible-galaxy collection install fortinet.fortimanager.
To use it in a playbook, specify: fortinet.fortimanager.fmgr_pkg_firewall_policy_obj.
New in version 2.10: of fortinet.fortimanager
Synopsis¶
This module is able to configure a FortiManager device by allowing the user to [ clone delete get move set update ] the following apis.
/pm/config/adom/{adom}/pkg/{pkg}/firewall/policy/{policy}
Examples include all parameters and values need to be adjusted to data sources before usage.
Parameters¶
Notes¶
Note
There are only three top-level parameters where ‘method’ is always required while other two ‘params’ and ‘url_params’ can be optional
Due to the complexity of fortimanager api schema, the validation is done out of Ansible native parameter validation procedure.
The syntax of OPTIONS doen not comply with the standard Ansible argument specification, but with the structure of fortimanager API schema, we need a trivial transformation when we are filling the ansible playbook
Examples¶
- hosts: fortimanager-inventory
collections:
- fortinet.fortimanager
connection: httpapi
vars:
ansible_httpapi_use_ssl: True
ansible_httpapi_validate_certs: False
ansible_httpapi_port: 443
tasks:
- name: REQUESTING /PM/CONFIG/PKG/{PKG}/FIREWALL/POLICY/{POLICY}
fmgr_pkg_firewall_policy_obj:
loose_validation: False
workspace_locking_adom: <value in [global, custom adom]>
workspace_locking_timeout: 300
method: <value in [clone, update]>
url_params:
adom: <value in [none, global, custom dom]>
pkg: <value of string>
policy: <value of string>
params:
-
data:
action: <value in [deny, accept, ipsec, ...]>
app-category: <value of string>
application:
- <value of integer>
application-list: <value of string>
auth-cert: <value of string>
auth-path: <value in [disable, enable]>
auth-redirect-addr: <value of string>
auto-asic-offload: <value in [disable, enable]>
av-profile: <value of string>
block-notification: <value in [disable, enable]>
captive-portal-exempt: <value in [disable, enable]>
capture-packet: <value in [disable, enable]>
comments: <value of string>
custom-log-fields: <value of string>
delay-tcp-npu-session: <value in [disable, enable]>
devices: <value of string>
diffserv-forward: <value in [disable, enable]>
diffserv-reverse: <value in [disable, enable]>
diffservcode-forward: <value of string>
diffservcode-rev: <value of string>
disclaimer: <value in [disable, enable]>
dlp-sensor: <value of string>
dnsfilter-profile: <value of string>
dscp-match: <value in [disable, enable]>
dscp-negate: <value in [disable, enable]>
dscp-value: <value of string>
dsri: <value in [disable, enable]>
dstaddr: <value of string>
dstaddr-negate: <value in [disable, enable]>
dstintf: <value of string>
firewall-session-dirty: <value in [check-all, check-new]>
fixedport: <value in [disable, enable]>
fsso: <value in [disable, enable]>
fsso-agent-for-ntlm: <value of string>
global-label: <value of string>
groups: <value of string>
gtp-profile: <value of string>
icap-profile: <value of string>
identity-based-route: <value of string>
inbound: <value in [disable, enable]>
internet-service: <value in [disable, enable]>
internet-service-custom: <value of string>
internet-service-id: <value of string>
internet-service-negate: <value in [disable, enable]>
ippool: <value in [disable, enable]>
ips-sensor: <value of string>
label: <value of string>
learning-mode: <value in [disable, enable]>
logtraffic: <value in [disable, enable, all, ...]>
logtraffic-start: <value in [disable, enable]>
match-vip: <value in [disable, enable]>
mms-profile: <value of string>
name: <value of string>
nat: <value in [disable, enable]>
natinbound: <value in [disable, enable]>
natip: <value of string>
natoutbound: <value in [disable, enable]>
ntlm: <value in [disable, enable]>
ntlm-enabled-browsers:
- <value of string>
ntlm-guest: <value in [disable, enable]>
outbound: <value in [disable, enable]>
per-ip-shaper: <value of string>
permit-any-host: <value in [disable, enable]>
permit-stun-host: <value in [disable, enable]>
policyid: <value of integer>
poolname: <value of string>
profile-group: <value of string>
profile-protocol-options: <value of string>
profile-type: <value in [single, group]>
radius-mac-auth-bypass: <value in [disable, enable]>
redirect-url: <value of string>
replacemsg-override-group: <value of string>
rsso: <value in [disable, enable]>
rtp-addr: <value of string>
rtp-nat: <value in [disable, enable]>
scan-botnet-connections: <value in [disable, block, monitor]>
schedule: <value of string>
schedule-timeout: <value in [disable, enable]>
send-deny-packet: <value in [disable, enable]>
service: <value of string>
service-negate: <value in [disable, enable]>
session-ttl: <value of integer>
spamfilter-profile: <value of string>
srcaddr: <value of string>
srcaddr-negate: <value in [disable, enable]>
srcintf: <value of string>
ssl-mirror: <value in [disable, enable]>
ssl-mirror-intf: <value of string>
ssl-ssh-profile: <value of string>
status: <value in [disable, enable]>
tags: <value of string>
tcp-mss-receiver: <value of integer>
tcp-mss-sender: <value of integer>
tcp-session-without-syn: <value in [all, data-only, disable]>
timeout-send-rst: <value in [disable, enable]>
traffic-shaper: <value of string>
traffic-shaper-reverse: <value of string>
url-category: <value of string>
users: <value of string>
utm-status: <value in [disable, enable]>
uuid: <value of string>
vlan-cos-fwd: <value of integer>
vlan-cos-rev: <value of integer>
voip-profile: <value of string>
vpn_dst_node:
-
host: <value of string>
seq: <value of integer>
subnet: <value of string>
vpn_src_node:
-
host: <value of string>
seq: <value of integer>
subnet: <value of string>
vpntunnel: <value of string>
waf-profile: <value of string>
wanopt: <value in [disable, enable]>
wanopt-detection: <value in [active, passive, off]>
wanopt-passive-opt: <value in [default, transparent, non-transparent]>
wanopt-peer: <value of string>
wanopt-profile: <value of string>
wccp: <value in [disable, enable]>
webcache: <value in [disable, enable]>
webcache-https: <value in [disable, ssl-server, any, ...]>
webfilter-profile: <value of string>
wsso: <value in [disable, enable]>
- name: REQUESTING /PM/CONFIG/PKG/{PKG}/FIREWALL/POLICY/{POLICY}
fmgr_pkg_firewall_policy_obj:
loose_validation: False
workspace_locking_adom: <value in [global, custom adom]>
workspace_locking_timeout: 300
method: <value in [delete]>
url_params:
adom: <value in [none, global, custom dom]>
pkg: <value of string>
policy: <value of string>
params:
-
data:
attr: <value in [label, global-label]>
name: <value of string>
- name: REQUESTING /PM/CONFIG/PKG/{PKG}/FIREWALL/POLICY/{POLICY}
fmgr_pkg_firewall_policy_obj:
loose_validation: False
workspace_locking_adom: <value in [global, custom adom]>
workspace_locking_timeout: 300
method: <value in [get]>
url_params:
adom: <value in [none, global, custom dom]>
pkg: <value of string>
policy: <value of string>
params:
-
option: <value in [object member, chksum, datasrc]>
- name: REQUESTING /PM/CONFIG/PKG/{PKG}/FIREWALL/POLICY/{POLICY}
fmgr_pkg_firewall_policy_obj:
loose_validation: False
workspace_locking_adom: <value in [global, custom adom]>
workspace_locking_timeout: 300
method: <value in [move]>
url_params:
adom: <value in [none, global, custom dom]>
pkg: <value of string>
policy: <value of string>
params:
-
option: <value in [before, after]>
target: <value of string>
- name: REQUESTING /PM/CONFIG/PKG/{PKG}/FIREWALL/POLICY/{POLICY}
fmgr_pkg_firewall_policy_obj:
loose_validation: False
workspace_locking_adom: <value in [global, custom adom]>
workspace_locking_timeout: 300
method: <value in [set]>
url_params:
adom: <value in [none, global, custom dom]>
pkg: <value of string>
policy: <value of string>
params:
-
data:
action: <value in [deny, accept, ipsec, ...]>
app-category: <value of string>
application:
- <value of integer>
application-list: <value of string>
auth-cert: <value of string>
auth-path: <value in [disable, enable]>
auth-redirect-addr: <value of string>
auto-asic-offload: <value in [disable, enable]>
av-profile: <value of string>
block-notification: <value in [disable, enable]>
captive-portal-exempt: <value in [disable, enable]>
capture-packet: <value in [disable, enable]>
comments: <value of string>
custom-log-fields: <value of string>
delay-tcp-npu-session: <value in [disable, enable]>
devices: <value of string>
diffserv-forward: <value in [disable, enable]>
diffserv-reverse: <value in [disable, enable]>
diffservcode-forward: <value of string>
diffservcode-rev: <value of string>
disclaimer: <value in [disable, enable]>
dlp-sensor: <value of string>
dnsfilter-profile: <value of string>
dscp-match: <value in [disable, enable]>
dscp-negate: <value in [disable, enable]>
dscp-value: <value of string>
dsri: <value in [disable, enable]>
dstaddr: <value of string>
dstaddr-negate: <value in [disable, enable]>
dstintf: <value of string>
firewall-session-dirty: <value in [check-all, check-new]>
fixedport: <value in [disable, enable]>
fsso: <value in [disable, enable]>
fsso-agent-for-ntlm: <value of string>
global-label: <value of string>
groups: <value of string>
gtp-profile: <value of string>
icap-profile: <value of string>
identity-based-route: <value of string>
inbound: <value in [disable, enable]>
internet-service: <value in [disable, enable]>
internet-service-custom: <value of string>
internet-service-id: <value of string>
internet-service-negate: <value in [disable, enable]>
ippool: <value in [disable, enable]>
ips-sensor: <value of string>
label: <value of string>
learning-mode: <value in [disable, enable]>
logtraffic: <value in [disable, enable, all, ...]>
logtraffic-start: <value in [disable, enable]>
match-vip: <value in [disable, enable]>
mms-profile: <value of string>
name: <value of string>
nat: <value in [disable, enable]>
natinbound: <value in [disable, enable]>
natip: <value of string>
natoutbound: <value in [disable, enable]>
ntlm: <value in [disable, enable]>
ntlm-enabled-browsers:
- <value of string>
ntlm-guest: <value in [disable, enable]>
outbound: <value in [disable, enable]>
per-ip-shaper: <value of string>
permit-any-host: <value in [disable, enable]>
permit-stun-host: <value in [disable, enable]>
policyid: <value of integer>
poolname: <value of string>
profile-group: <value of string>
profile-protocol-options: <value of string>
profile-type: <value in [single, group]>
radius-mac-auth-bypass: <value in [disable, enable]>
redirect-url: <value of string>
replacemsg-override-group: <value of string>
rsso: <value in [disable, enable]>
rtp-addr: <value of string>
rtp-nat: <value in [disable, enable]>
scan-botnet-connections: <value in [disable, block, monitor]>
schedule: <value of string>
schedule-timeout: <value in [disable, enable]>
send-deny-packet: <value in [disable, enable]>
service: <value of string>
service-negate: <value in [disable, enable]>
session-ttl: <value of integer>
spamfilter-profile: <value of string>
srcaddr: <value of string>
srcaddr-negate: <value in [disable, enable]>
srcintf: <value of string>
ssl-mirror: <value in [disable, enable]>
ssl-mirror-intf: <value of string>
ssl-ssh-profile: <value of string>
status: <value in [disable, enable]>
tags: <value of string>
tcp-mss-receiver: <value of integer>
tcp-mss-sender: <value of integer>
tcp-session-without-syn: <value in [all, data-only, disable]>
timeout-send-rst: <value in [disable, enable]>
traffic-shaper: <value of string>
traffic-shaper-reverse: <value of string>
url-category: <value of string>
users: <value of string>
utm-status: <value in [disable, enable]>
uuid: <value of string>
vlan-cos-fwd: <value of integer>
vlan-cos-rev: <value of integer>
voip-profile: <value of string>
vpn_dst_node:
-
host: <value of string>
seq: <value of integer>
subnet: <value of string>
vpn_src_node:
-
host: <value of string>
seq: <value of integer>
subnet: <value of string>
vpntunnel: <value of string>
waf-profile: <value of string>
wanopt: <value in [disable, enable]>
wanopt-detection: <value in [active, passive, off]>
wanopt-passive-opt: <value in [default, transparent, non-transparent]>
wanopt-peer: <value of string>
wanopt-profile: <value of string>
wccp: <value in [disable, enable]>
webcache: <value in [disable, enable]>
webcache-https: <value in [disable, ssl-server, any, ...]>
webfilter-profile: <value of string>
wsso: <value in [disable, enable]>
- name: REQUESTING /PM/CONFIG/PKG/{PKG}/FIREWALL/POLICY/{POLICY}
fmgr_pkg_firewall_policy_obj:
loose_validation: False
workspace_locking_adom: <value in [global, custom adom]>
workspace_locking_timeout: 300
method: <value in [set]>
url_params:
adom: <value in [none, global, custom dom]>
pkg: <value of string>
policy: <value of string>
params:
-
data:
attr: <value in [label, global-label]>
name: <value of string>
Return Values¶
Common return values are documented here, the following are the fields unique to this module:
| Key | Returned | Description |
|---|---|---|
|
data
dictionary
|
always |
The payload returned in the request
|
|
status
dictionary
|
always |
The status of api request
|
|
url
string
|
always |
The full url requested
Sample:
/sys/login/user
|
Authors¶
Frank Shen (@fshen01)
Link Zheng (@zhengl)